一种基于超统计理论的非平稳时间序列异常点检测方法研究

摘要

从非平稳时间序列的分布函数及其参数入手,主要研究分布函数不变分布参数变化的这一类非平稳的时间序列异常点检测方法,提出了基于超统计的异常检测方法,并将其应用于非平稳网络流量时间序列.从网络流量的非平稳和突发性特点出发,特别考虑到由于攻击流量所引起的流量特性的变化,结合超统计理论,主要研究分布参量的变化.根据超统计的理论,先应建立分布统计模型,研究分布模型不同参数变化对分布的决定性作用,从而将异常网络流量的检测研究转化成对慢变量参数序列的检测研究.该检测方法大大降低了计算的复杂度.通过大量实验表明该方法具有良好的效果.%Because of network traffic non-stationary property it can hardly use traditional way to analyze the complicated network traffic.A new detection method of non-stationary network traffic based on superstatistics theory was discussed.According to the superstatistics theory, the complex dynamic system may have a large fluctuation of intensive quantities on large time scales which causes the system to behave as non-stationary which is also the characteristic of network traffic.This new idea provides us with a novel method to partition the non-stationary traffic time series into small stationary segments.We used the slow parameters of the segments as a key determinant factor of the system to describe the network characteristic and analyze the slow parameters with time series theory to detect network anomaly.The result of experiments indicates that this method can be effective.